AWS CloudWatch Logs Publisher Plugin stores credentials in plain text

AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file jenkins.plugins.awslogspublisher.AWSLogsConfig.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

USN-3930-1: Linux kernel vulnerabilities

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture ALSA subsystem. A physically proximate attacker could use this to cause a denial of service system crash. CVE-2018-19824 Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an...

[SECURITY] Fedora 29 Update: openwsman-2.6.5-9.fc29

Openwsman is a project intended to provide an open-source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

Input validation

A vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

CVE-2019-1755

A vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

CVE-2019-1755 Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

CVE-2019-1753: Improper Input Validation

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent WSMA...

Cisco IOS XE Command Injection Vulnerability (CNVD-2019-10462)

Cisco IOS XE is a modular operating system based on the Linux kernel. A command injection vulnerability exists in the Web Services Management Agent WSMA feature of Cisco IOS XE, which stems from a failure to validate user-supplied input, and can be exploited by a remote authenticated attacker to...

CVE-2019-1755: Improper Input Validation

A vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in the Web Services Management Agent WSMA function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied...

Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent WSMA...

PT-2019-1711

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged remote attacker to run privileged Cisco IOS commands by using the web UI. Th...

PT-2019-1737

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue exists due to insufficient input validation in the Web Services Management Agent WSMA component of Cisco IOS XE Software. This allows a remote attacker to execute...

CVE-2019-8989

The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affected releases are TIBCO Software Inc.'s...

Important: Red Hat Security Advisory: openwsman security update

An update for openwsman is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

PT-2019-19291 · Tibco Software · Tibco Spotfire Data Science +1

Name of the Vulnerable Software and Affected Versions: TIBCO Data Science for AWS versions up to and including 6.4.0 TIBCO Spotfire Data Science versions up to and including 6.4.0 Description: The application server component of TIBCO Software Inc.'s products contains a persistent cross-site...

PT-2019-18718 · Interpeak +1 · Interpeak Ipwebs +1

Name of the Vulnerable Software and Affected Versions: Interpeak IPWEBS on Green Hills INTEGRITY RTOS version 5.0.4 Description: The issue is related to the allocation of 60 bytes for the HTTP Authentication header in Interpeak IPWEBS on Green Hills INTEGRITY RTOS. When copying this header to...

Critical DoS Bug Bubbles Up in Facebook Fizz TLS 1.3 Project

A critical denial-of-service DoS vulnerability in Facebook’s open-source implementation of the transport layer security TLS 1.3 protocol could cause an infinite loop – thus disrupting any web service that relies on it. Kevin Backhouse, a researcher at Semmle, discovered the bug in the project...

Why DevOps is Becoming More Like DevSecOps

Editor's Note: Sam Bocetta, a guest author on the Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. In the year 2000, a Time magazine essay authored by Steward...

AWS Certification Training Courses – Get 2019 Bundle @ 96% OFF

With countless web apps and online services launching every day, there is an increasing demand for cloud developers. This exciting niche is due to grow rapidly over the next few years, and the paycheck should follow suit. If you want to build a career in this lucrative niche, it pays to know AWS...